Vulnerabilidades em Nextcloud
306 resultadosAnálise Vexday
Nextcloud possui 20 vulnerabilidades registradas na base, todas de severidade moderada ou inferior, com destaque para falhas de Cross-Site Scripting (CWE-79). Nenhuma vulnerabilidade está sob ataque ativo conhecido, e não há publicações recentes nos últimos 90 dias, indicando um panorama de risco estável e sem pressão imediata.
CVE-2022-31132HIGHUnauthenticated SSRF in 3rd party module "cerdic/csstidy"EPSS 0.7%CVE-2017-0895—Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note thatEPSS 0.7%CVE-2023-39958MEDIUMMissing brute force protection on password reset token OAuth2 API controllerEPSS 0.7%CVE-2023-39960MEDIUMNextcloud Server has improper restriction of excessive authentication attempts on WebDAV endpointEPSS 0.7%CVE-2023-22469MEDIUMNextcloud Deck card vulnerable to data leak to unauthorized users via reference preview cacheEPSS 0.7%CVE-2021-29438MEDIUMImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in @nextcloud/dialogsEPSS 0.7%CVE-2024-52515MEDIUMNextcloud Server has incomplete sanitization of SVG files allows to embed other images into previewsEPSS 0.7%CVE-2023-32319HIGHBasic auth header on WebDAV requests is not brute-force protected in NextcloudEPSS 0.7%CVE-2023-22470LOWNextcloud Deck vulnerable to uncontrolled resource consumption EPSS 0.7%CVE-2022-39212MEDIUMLast video frame is still sent after video is disabled in a call in Nextcloud TalkEPSS 0.7%CVE-2023-23942MEDIUMSelf reflected HTML injection in Desktop clientEPSS 0.7%CVE-2023-28998MEDIUMNextcloud Desktop client misbehaves with E2EE when the server returns empty list of metadata keysEPSS 0.7%CVE-2024-52523MEDIUMNextcloud Server Custom defined credentials of external storages are sent back to the frontendEPSS 0.7%CVE-2023-28999MEDIUMNextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE foldersEPSS 0.7%CVE-2022-41970LOWNextcloud Server's disabled download shares still allow download through preview imagesEPSS 0.7%CVE-2023-48303LOWNextcloud Server admins can change authentication details of user configured external storageEPSS 0.7%CVE-2017-0884—Nextcloud Server before 9.0.55 and 10.0.2 suffers from a creation of folders in read-only folders despite lacking permissions issue. Due to EPSS 0.7%CVE-2022-24889LOWInsufficient Verification of Data Authenticity in Nextcloud ServerEPSS 0.7%CVE-2023-30540LOWChat poll data can still be queried from API after purging history in Nextcloud talkEPSS 0.7%CVE-2022-39338LOWStored cross site scripting (XSS) vulnerability via Authorization Endpoint in user_oidcEPSS 0.7%